RE: <info> Command and authInfo

[Bruce Tonkin <Bruce.Tonkin@melbourneit.com.au>]

Hello Scott,

> 
> This might be a reasonable compromise.  My initial thought 
> was to restrict
> it completely, but maybe there's no harm in returning a 
> subset of the info
> if the querying client isn't the sponsor and doesn't have the 
> authInfo.
> 

I prefer the latter option.  ie returning different subsets of information
depending on the credentials of the party executing the <info> command.

Bear in mind, that in future the use of EPP to talk to the registry may not
be restricted to entities such as authorised registrars (that is really only
an artifact of the current ".biz", ".info" etc structure).  There is no
reason why any member of public should not be able to query the registry via
EPP (and get the advantage of structured XML responses) and get back public
info (such as WHOIS info).  Of course you could even create a separate WHOIS
like service using separate infrastructure that responds to EPP <info>
commands.  In some ways it may relieve some of the debate in WHOIS - where
debate runs wild on appropriate data formats etc.

Regards,
Bruce Tonkin